Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12,583 detections
Filters
Last updated
All Time
Detection languages
5,139
3,901
1,034
828
476
Contributors
2,488
1,655
1,442
1,408
970
Categories
3,444
1,825
1,661
1,578
1,416
Platforms
8,040
1,889
1,334
1,053
778
Products / Services
1,979
1,796
1,633
1,096
1,041
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
21
21
21
19
14
IDS Classtypes
136
73
43
15
14
IDS Protocols
150
123
15
12
6
Detects administrative login to the ePO console. An ePO administrator can change
protection policy, create exclusions and push software to every managed endpoint —
which makes this account one of the highest-value targets in any estate running it.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-EPO' and action='LOGIN'
| groupby user, srcip, authproto
protection policy, create exclusions and push software to every managed endpoint —
which makes this account one of the highest-value targets in any estate running it.
Onboarding: TRELLIX-EPO is ingested via RDBMS Log Shipper (Bloo extractor 857).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=authentication where sourcename='TRELLIX-EPO' and action='LOGIN'
| groupby user, srcip, authproto
Detects mail redirection on Zimbra Collaboration. Zimbra is widely deployed in
government, education and smaller enterprises, has been the subject of repeated
mass-exploitation campaigns, and is rarely covered by commercial detection content —
the combination makes it a persistent soft target.
Redirection is the standard persistence on a compromised mailbox: it survives
password resets and quietly copies correspondence onward.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='ZIMBRA' and action='EMAIL_REDIRECTED'
| groupby sender, recipient, direction, remoteip, subject
government, education and smaller enterprises, has been the subject of repeated
mass-exploitation campaigns, and is rarely covered by commercial detection content —
the combination makes it a persistent soft target.
Redirection is the standard persistence on a compromised mailbox: it survives
password resets and quietly copies correspondence onward.
Onboarding: ZIMBRA is ingested via Syslog (Bloo extractor 123).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='ZIMBRA' and action='EMAIL_REDIRECTED'
| groupby sender, recipient, direction, remoteip, subject
Detects authentication to the Barracuda load balancer management interface. Appliance
management accounts are often shared, rarely rotated and seldom covered by the
identity controls applied elsewhere, which makes them a durable route back in.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='BARRACUDA-LOADBALANCER' and action='LOGIN'
| groupby user, srcip, authproto
management accounts are often shared, rarely rotated and seldom covered by the
identity controls applied elsewhere, which makes them a durable route back in.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='BARRACUDA-LOADBALANCER' and action='LOGIN'
| groupby user, srcip, authproto
Detects account creation on the wireless controller. Network infrastructure accounts
are frequently local to the device, outside central identity management and never
reviewed — which makes one created by an attacker an exceptionally durable way back
into the network.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_ADDED'
| groupby user, targetuser, role
are frequently local to the device, outside central identity management and never
reviewed — which makes one created by an attacker an exceptionally durable way back
into the network.
Onboarding: CISCO-AIR-CT5508-K9 is ingested via Syslog (Bloo extractor 201).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CISCO-AIR-CT5508-K9' and action='USER_ADDED'
| groupby user, targetuser, role
Detects MFT authentication from a source address without prior history. Transfer
platforms are reached by a small, stable set of partners and internal systems, so
the population of legitimate source addresses is unusually predictable — which makes
a new one unusually meaningful.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='GOANYWHERE-MFT' and action='LOGIN'
| duration 24h
| groupby srcip, user, authproto
platforms are reached by a small, stable set of partners and internal systems, so
the population of legitimate source addresses is unusually predictable — which makes
a new one unusually meaningful.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='GOANYWHERE-MFT' and action='LOGIN'
| duration 24h
| groupby srcip, user, authproto
Detects a Slack role change conferring administrative rights. A workspace admin can
read private content, export conversation history, add applications and change
retention — so this is a meaningful privilege grant in a system that holds a great
deal of candid organisational information.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=iam where sourcename='SLACK' and action='ROLE_ADDED'
| groupby user, targetuser, role, workspace
read private content, export conversation history, add applications and change
retention — so this is a meaningful privilege grant in a system that holds a great
deal of candid organisational information.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=iam where sourcename='SLACK' and action='ROLE_ADDED'
| groupby user, targetuser, role, workspace
Detects mail being redirected to an external recipient. Redirection rules are the
classic persistence mechanism on a compromised mailbox: they survive password resets,
require no further access, and quietly copy correspondence to the attacker for as
long as they remain in place.
This is among the most under-monitored controls in most estates, because the rule is
set once and never fires an alert again.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE'
and action='EMAIL_REDIRECTED'
| groupby sender, recipient, direction, remoteip
classic persistence mechanism on a compromised mailbox: they survive password resets,
require no further access, and quietly copy correspondence to the attacker for as
long as they remain in place.
This is among the most under-monitored controls in most estates, because the rule is
set once and never fires an alert again.
Onboarding: MS-EXCHANGE is ingested via Syslog (Bloo extractor 142).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=email-gateway where sourcename='MS-EXCHANGE'
and action='EMAIL_REDIRECTED'
| groupby sender, recipient, direction, remoteip
Detects a privileged session beginning with no preceding credential retrieval by the
same account. The expected sequence is checkout then session. A session without one
suggests the credential was obtained outside the vault — cached, shared, or stolen —
which defeats the control the vault exists to provide.
Correlate SESSION_STARTED in the audit stream against PASSWORD_RETRIEVED in the iam
stream for the same user within a preceding window.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=audit where sourcename='PAM360' and action='SESSION_STARTED'
| groupby user, targetuser, srcip, devicetype
same account. The expected sequence is checkout then session. A session without one
suggests the credential was obtained outside the vault — cached, shared, or stolen —
which defeats the control the vault exists to provide.
Correlate SESSION_STARTED in the audit stream against PASSWORD_RETRIEVED in the iam
stream for the same user within a preceding window.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=audit where sourcename='PAM360' and action='SESSION_STARTED'
| groupby user, targetuser, srcip, devicetype
Detects one endpoint authenticating under several distinct user identities in a short
period. A workstation normally carries one user at a time. Several identities from
one endpoint suggests credential testing, a shared or kiosk device being misused, or
an attacker working through harvested accounts from a single foothold.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CISCO-ISE' and action='LOGIN'
| duration 1h
| groupby srcip
| select srcip, distinct_count(user)
| having distinct_count_col1 > 4
period. A workstation normally carries one user at a time. Several identities from
one endpoint suggests credential testing, a shared or kiosk device being misused, or
an attacker working through harvested accounts from a single foothold.
Onboarding: CISCO-ISE is ingested via Syslog (KV) (Bloo extractor 196).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=authentication where sourcename='CISCO-ISE' and action='LOGIN'
| duration 1h
| groupby srcip
| select srcip, distinct_count(user)
| having distinct_count_col1 > 4
Detects a privileged password change shortly after failed authentication attempts
against the vault. An attacker who gains vault access frequently rotates the
credential to lock out the legitimate owner and secure their own hold on it.
The sequence matters more than either event alone: failures followed by a successful
change is the pattern, and a change on its own is routine.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CYBERARK' and action='PASSWORD_CHANGED'
| groupby user, targetuser, srcip, reason
against the vault. An attacker who gains vault access frequently rotates the
credential to lock out the legitimate owner and secure their own hold on it.
The sequence matters more than either event alone: failures followed by a successful
change is the pattern, and a change on its own is routine.
Onboarding: CYBERARK is ingested via Syslog (CEF) (Bloo extractor 279).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=iam where sourcename='CYBERARK' and action='PASSWORD_CHANGED'
| groupby user, targetuser, srcip, reason
Detects a user being added to a role within ClearPass. Role membership determines
what the network will permit an identity to reach, so granting a privileged role is
a network-layer privilege escalation that leaves no trace on any endpoint.
Additions outside provisioning hours, or by an account that does not normally
administer ClearPass, are the ones worth pursuing.
Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261).
Integration guide: https://bloo.io/docs/integrations/aruba-clearpass
BQL (Bloo Query Language):
stream=iam where sourcename='ARUBA-CLEARPASS' and action='USER_ADDED'
| groupby user, targetuser, role, srcip
what the network will permit an identity to reach, so granting a privileged role is
a network-layer privilege escalation that leaves no trace on any endpoint.
Additions outside provisioning hours, or by an account that does not normally
administer ClearPass, are the ones worth pursuing.
Onboarding: ARUBA-CLEARPASS is ingested via Syslog (CEF) (Bloo extractor 261).
Integration guide: https://bloo.io/docs/integrations/aruba-clearpass
BQL (Bloo Query Language):
stream=iam where sourcename='ARUBA-CLEARPASS' and action='USER_ADDED'
| groupby user, targetuser, role, srcip
Detects successful Azure Active Directory (Entra ID) sign-ins using the device code flow where the originating device is neither registered nor trusted (managed or compliant), which may indicate suspicious authentication attempts or token abuse.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
Builds a per-account baseline of the devices that each enabled service account has made a successful network logon to over the previous 30 days, then alerts when one makes a successful network logon to a device outside that baseline within the latest window.
Service accounts are identified from IdentityInfo using each account’s most recent recorded type and enabled status, and are matched to logon events by their on-premises SID, so local accounts or accounts in other domains that share the same name are not mistaken for them. Accounts with no logon history in the baseline period are still evaluated, so a dormant service account that suddenly begins making network logons will alert on every device it reaches.
Service accounts tend to touch a small, fixed set of hosts, so a per-entity first-seen check is a strong lateral movement signal with less noise than the same logic applied to users.
Each result is enriched with the number of times the destination device’s sensor reporting restarted during the alert window, along with the times of those restarts in UTC, as restarts close to the new logons often indicate maintenance activity such as patching, although they should prompt a check to confirm rather than closure of the alert.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
Service accounts are identified from IdentityInfo using each account’s most recent recorded type and enabled status, and are matched to logon events by their on-premises SID, so local accounts or accounts in other domains that share the same name are not mistaken for them. Accounts with no logon history in the baseline period are still evaluated, so a dormant service account that suddenly begins making network logons will alert on every device it reaches.
Service accounts tend to touch a small, fixed set of hosts, so a per-entity first-seen check is a strong lateral movement signal with less noise than the same logic applied to users.
Each result is enriched with the number of times the destination device’s sensor reporting restarted during the alert window, along with the times of those restarts in UTC, as restarts close to the new logons often indicate maintenance activity such as patching, although they should prompt a check to confirm rather than closure of the alert.
The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and the alert window covers the last 25 hours so that a slightly delayed run does not leave a gap.
The baseline and alert windows are separated by ingestion time rather than event time, so events that arrive late are still evaluated.
Detects the creation or modification of web script files (.aspx, .jsp) within common web application directories by unusual processes (such as command shells or download utilities) or by non-standard user accounts, indicating potential web shell deployment.
Detects a service principal adding itself or another principal to a directory role in Azure Active Directory, specifically highlighting known ConnectWise supply-chain related activity.
Detects potential debugger detection evasion attempts via command line arguments associated with debugging checks or process execution of debugging utilities, as well as persistence configuration using Image File Execution Options (IFEO) or AeDebug registry keys targeting debuggers.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Generic rule content from file: Iranian APT - Blinder Tunnel - MicrosoftRuntime Run Key Persistence.cql
Detects creation of a scheduled task named "Windows Defender Advanced
Threat Protection Service" configured to run at system startup with SYSTEM privileges
and launch an executable named defender.exe. HoneyMyte (Mustang Panda) used this exact
schtasks command to establish boot persistence for the CoolClient backdoor sideloader,
masquerading the task and binary as a legitimate Windows Defender component.
Threat Protection Service" configured to run at system startup with SYSTEM privileges
and launch an executable named defender.exe. HoneyMyte (Mustang Panda) used this exact
schtasks command to establish boot persistence for the CoolClient backdoor sideloader,
masquerading the task and binary as a legitimate Windows Defender component.
Page 7 of 600